KVM security bug: no forwarding rule applied